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Practitioner's Docket No. NAI1P360/00.148.01 pa TENT 

IN THE UNITED STATES PATENT AND TRADEMARK OFFICE 

In re application of: Edwards et al. 

Application No.: 09/823,438 Group No.: 2137 

Filed: 03/30/2001 Examiner: Michael Pyzocha 

For: VIRUS SCANNING PRIORITIZATION USING PRE-PROCESSOR CHECKING 

Mail Stop Appeal Briefs - Patents 
Commissioner for Patents 
P.O. Box 1450 

Alexandria, VA 22313-1450 

TRANSMITTAL OF APPEAL BRIEF 
(PATENT APPLICATION-37 C JUL § 1.192) 

1. Transmitted herewith is the APPEAL BRIEF in this application, with respect to the Notice of 
Appeal filed on April 28, 2005. 

2. STATUS OF APPLICANT 

This application is on behalf of other than a small entity. 



CERTIFICATION UNDER 37 C.FJL §§ 1.8(a) and 1.10* 

(When using Express Mail, the Express Mail label number is mandatory; 
Express Mail certification is optional) 

I hereby certify that, on the date shown below, this correspondence is being: 

MAILING 

_ deposited with the United States Postal Service m an envelope addressed to the Commi&sioner for Patents, P.O. Box 1450, Alexandria, VA 
22313-1450. 

37 CJ.R. § 1 J(a) 37 C-F.R. § 1.10* 
_ with sufficient postage as first class mail. _ as "Express Mail Post Office to Addressee- 
Mailing Label No. (mandatory) 

TRANSMISSION 

_ facsimile transmitted to the Patent and Trademark Office, (703) 872-9306. 



Jamie L. Rossi 



(type or prim name of person certifying) 



* Only the date of filing (' 1.6) \vifl be the date used in a patent term adjustment calculation. atUiough the date on any certificate of mailing or 
transmission under ' 1.3 continues to be taken into account in determining timeliness. See ' 1. 703(f). Consider "Express Mail Post Office to 
Addressee " (' l.JO) or facsimile transmission ( ' /. 6(d)) for the reply to be accorded the earliest possible filing date for patent term adjustment 
calculations. 

Transmittal of Appeal Brief— page I of 2 
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RECEIVED 

CENTRAL FAX CENTER 

JUN 2 8 2005 



3. FEE FOR FILING APPEAL BRIEF 
Pursuant to 37 C.F.R. § 41.20(b)(2), the fee for filing the Appeal Brief is: 
other than a small entity $500.00 

Appeal Brief fee due $500.00 

4. EXTENSION OF TERM 

The proceedings herein are for a patent application and the provisions of 37 C.F.R. § 1.136 apply. 

Applicant believes that no extension of term is required. However, this conditional petition is 
being made to provide for the possibility that applicant has inadvertently overlooked the need for a 
petition and fee for extension of time. 



5. 



TOTAL FEE DUE 

The total fee due is: 

Appeal brief fee 
Extension fee (if any) 

FEE PAYMENT 



$500.00 
$0.00 

TOTAL FEE DUE $500.00 



7. 



Authorization is hereby made to charge the amount of $500.00 to Deposit Account No. 50-1351 
(Order No. NAI1P360). 

A duplicate of this transmittal is attached. 

FEE DEFICIENCY 

If any additional extension and/or fee is required, ana if any/ad(3if3nal fee for claims is required, 
charge Deposit Account No. 50-1 35 1 (Order No^AIlp/ 

( // // x 



Reg. No.: 41,429 
Tel. No.: 408-971-2573 
Customer No.: 28875 




Signature 
Kevin J. Zilka 
Zilka-Kotab, 
P.O. Box 72 
San Jose, CA 
USA 
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Practitioner's Docket No. NAI1P3 60/00. 3 48.01 

IN THE UNITED STATES PATENT AND TRADEMARK OFFICE 

In re application of: Edwards et a]. 

Application No.: 09/823,438 Group No.: 2137 

Filed: 03/30/2001 Examiner: Michael Pyzocha 

For: VIRUS SCANNING PRIORITIZATION USING PRE-PROCESSOR CHECKING 

Mail Stop Appeal Briefs - Patents 
Commissioner for Patents 
P.O. Box 1450 

Alexandria, VA 22313-1450 

TRANSMITTAL OF APPEAL BRIEF 
(PATENT APPLICATION-37 CJFJt. § 1.192) 

1. Transmitted herewith is the APPEAL BRIEF in this application, with respect to the Notice of 
Appeal flted on April 28, 2005. 

2. STATUS OF APPLICANT 

This application is on behalf of other than a small entity. 



PATENT 

RECEIVED 

CENTRAL FAX CENTER 

JUN 2 8 2005 



CERTIFICATION UNDER 37 C.F.R. §§ 1.8(a) and 1.10* 

(When using Express Mail, the Express Mail label number is mandatory; 
Express Mail certification is optional) 

I hereby certify that, on the date shown below, this correspondence is being: 

MAILING 

_ deposited with the United Slates Postal Service in an envelope addressed to the Commissioner for Patents, P.O. Box 1450, Alexandria VA 
22313-1450. 

37 C.F.U. § 1.8(a) t 37 C ,F.R. § M0* 
- with sufficient postage as first class mail. _ as "Express Mail Post Office to Addressee- 
Mailing Label No. (mandatory) 

TRANSMISSION 

_ facsimile transmitted to the Patent and Trademark Office, (703) 872-9306. 



Date: 




(type or print name of person certifying} 

* Only the date of filing (' 1.6) will be the date used in a patent term adjustment calculation, although the date on any certificate of mailing or 
transmission under ' 1.8 continues to be taken into account in determining timeliness. See ' /. 7030. Consider "Express Mail Post Office to 
Addressee "(• J. 10) or facsimile transmission ( ' /.6(d)) for the reply to be accorded the earliest possible filing date for patent term adjustment 
calculations. 

Transmittal of Appeal Brief-page 1 of 2 
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3. FEE FOR FILING APPEAL BRIEF 

Pursuant to 37 C.F.R. § 41 .20(b)(2), the fee for filing the AppealBrief is: 
other than a small entity $500.00 

Appeal Brief fee due $500.00 

4. EXTENSION OF TERM 

The proceedings herein are for a patent application and the provisions of 37 C.F.R. § 1 .136 apply. 

Applicant believes that no extension of term is required. However, this conditional petition is 
being made to provide for the possibility that applicant has inadvertently overlooked the need for a 
petition and fee for extension of time. 

5. TOTAL FEE DUE 

The total fee due is: 

Appeal brief fee 
Extension fee (if any) 



$500.00 
$0.00 



TOTAL FEE DUE $500.00 



6. FEE PAYMENT 



7. 



Authorization is hereby made to charge the amount of $500.00 to Deposit Account No. 50-1351 
(Order No. NAI1P360). 

A duplicate of this transmittal is attached. 
FEE DEFICIENCY 



If any additional extension and/or fee is required, - 
charge Deposit Account No. 50-1351 (Order NoyN. 



Reg. No.; 41,429 
Tel. No.: 408-971-2573 
Customer No.: 28875 



fee for claims is required, 




Signaturi 
Kevin J. 
Zilka-I£6tab, 
P.O. Box 72 
San Jose, C A 
USA 



Transmittal of Appeal Brief-page 2 of 2 
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RECEIVED 

CENTRAL FAX CENTER 



JUN 2 8 2005 



f PATENT 

IN THE UNITED STATE S PATENT AND TRADEMARK - nvmrv 
In re application of: 
Edwards etal. 
Application No. 09/823,438 
Filed: March 30, 2001 



For: VIRUS SCANNING PRIORITIZATION) 
USING PRE-PROCESSOR CHECKING 



Group Art Unit 2137 
Examiner: Pyzocha, Michael 
Date: June 28,2005 



Commissioner for Patents 
P.O. Box 1450 
Alexandria, VA 22313-1450 

ATTENTION: Board of Patent Appeals and Interferences 

APPEAL BRIEF (37 C.F.R. § 4137) 

This brief is in furtherance of the Notice of Appeal, filed in this case on April 28, 2005. 

The fees required under § 1.17, and any required petition for extension of time for filing 
this brief and fees therefor, are dealt with in the accompanying TRANSMITTAL OF 
APPEAL BRIEF. 

This brief contains these items under the following headings, and in the order set forth 
below (37 C.F.R. § 41.37(c)(i)): 



I 

II 

III 

IV 

V 

VI 

vn 



REAL PARTY IN INTEREST 

RELATED APPEALS AND INTERFERENCES 

STATUS OF CLAIMS 

STATUS OF AMENDMENTS 

SUMMARY OF CLAIMED SUBJECT MATTER 

ISSUES 

ARGUMENTS 
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VIII APPENDIX OF CLAIMS INVOLVED IN THE APPEAL 

IX APPENDIX LISTING ANY EVIDENCE RELIED ON BY THE APPELLANT 
IN THE APPEAL 

The final page of this brief bears the practitioner's signature. 
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I REAL PARTY IN INTEREST (37 C.FJR. § 41.37(c)(l)(i)) 
The real party in interest in this appeal is McAfee, Inc. 
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II RELATED APPEALS AND INTERFERENCES (37 CJ.R. § 41.37(c) (1)00) 

With respect to other prior or pending appeals, interferences, or related judicial 
proceedings fliat will directly affect, or be directly affected by, or have a bearing on the 
Board's decision in the pending appeal, there are no other such appeals, interferences, or 
related judicial proceedings. 

Since no such proceedings exist, no Related Proceedings Appendix is appended hereto. 
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HI STATUS OF CLAIMS (37 C.F.R. § 41.37(c) (l)(iii)) 

A. TOTAL NUMBER OF CLAIMS IN APPLICATION 

Claims in the application are: 1-5, 7-1 1, 17-23, 25-29, 35-41, 43^47 and 53-59 

B. STATUS OF ALL THE CLAIMS IN APPLICATION 

1 . Claims withdrawn from consideration: None 

2. Claims pending: 1-5, 7-1 1 , 17-23, 25-29, 35-41, 43-47 and 53-59 

3. Claims allowed: None 

4. Claims rejected: 1-5, 7-1 1 , 1 7-23, 25-29, 35-41, 43-47 and 53-59 
C, CLAIMS ON APPEAL 

The claims on appeal are: 1-5, 7-11, 17-23, 25-29, 35-41, 43-47 and 53-59 
See additional status information in the Appendix of Claims. 
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IV STATUS OF AMENDMENTS (37 C.F.R. § 4137(c)(l)(iv)) 

As to the status of any amendment, filed subsequent to final rejection, there are no such 
amendments after final. 



-6- 
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V SUMMARY OF CLAIMED SUBJECT MATTER (37 C.F.R. § 41.37(c)(l)(v)) 

With respect to a summary of Claim 1 et al, as shown in Figures 3 and 4, a method 
for prioritizing virus scan requests is provided including checking a virus scan 
request to determine if scanning an object of the request is necessary (e.g. item 320 
of Figure 3) and placing the virus scan request on a queue in a priority order based 
on a characteristic of the virus scan request (e.g. item 350 of Figure 3). The 
characteristic includes at least one of an identity of the user triggering the virus scan 
request, a type of the process accessing the object, a time stamp of when the virus 
request was received, and an indication of a network node accessing the object, 
wherein the virus scan request is prioritized based on at least one of the user identity 
being an administrator as compared to a regular user, the process type being an 
operating system as compared to a user appellant, the time stamp being earlier than 
the time stamps of each scan request previously placed on the queue, and the 
indication being that the object is accessed from a server console as compared to a 
network client (e.g. item 430 of Figure 3). Note page 13, line 9 - page 14, line 18 
and page 1 1 , line 8 - page 1 2, line 6, for example. 

With respect to a summary of Claim 37 et al., the above summary is incorporated, at 
least in part, by reference. In addition, Figure 5 shows a virus scanner including a pre- 
processor thread that checks a virus scan request to determine if scanning an object of 
the request is necessary (e.g. item 320 of Figure 3) and a queue that receives the virus 
scan request in a priority order based on characteristics of the virus scan request, the 
characteristics including at least two of an identity of the user triggering the virus scan 
request, a type of the process accessing the object, a time stamp of when the virus scan 
request was received, and an indication of a network node accessing the object, wherein 
the virus scan request is prioritized based on at least two of the user identity being an 
administrator as compared to a regular user, the process type of being an operating 
system as compared to a user application, the time stamp being earlier than the time 
stamps of each scan request previously placed on the queue, and the indication being 
that the object is accessed from a server console as compared to a network client (e.g. 
items 530-550 of Figure 5). Note page 14, line 19 -page 15, line 13, for example. 



-7- 
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With respect to a summary of Claim 55 et al., the above summaries are incorporated, 
at least in part, by reference. In addition, Figure 6 shows a computer system is 
provided including a processor coupled to a system bus (e.g. item 605 of Figure 6), a 
memory coupled to the processor through the system bus (e.g. items 602-604 of 
Figure 6), a machine-accessible medium coupled to the processor through the 
system bus (e.g. items 621-627 of Figure 6), and a virus scanning process executed 
from the machine-accessible medium by Ihe processor, wherein the virus scanning 
process causes the processor to check a virus scanning request to determine if 
scanning an object of the request is necessary, and if so to further place the checked 
virus scan request on a queue in a priority order based on characteristics of the virus 
scan request, the characteristics including each of an identity of the user triggering 
the virus scan request, a type of the process accessing the object, a time stamp of 
when the virus scan request was received, and an indication of a network node 
accessing the object, wherein the virus scan request is prioritized based on the user 
identity being an administrator as compared to a regular user, the process type being 
an operating system as compared to a user application, the time stamp being earlier 
than the time stamps of each scan request previously placed on the queue, and we 
indication being that the object is accessed from a server console as compared to a 
network client (e.g. item 430 of Figure 3). Note page 1 5, line 14 - page 17, line 1 8, 
for example. 



-8- 
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VI ISSUES (37 C.F.R. § 41.37(c)(l)(vi)) 

Following, under each issue listed, is a concise statement setting forth the corresponding 
ground of rejection. 

Issue # 1: The Examiner has rejected Claims 1-11, 17, 19-23, 25-29 and 35 under 35 
U.S.C. 103(a) as being unpatentable over Chess et aL, U.S. Patent No. 6,560,632 in 
view of Wong, U.S. Patent No. 5,974,465 . 

Issue # 2: The Examiner has rejected Claims 18 and 36 under 35 U.S.C. 103(a) as being 
unpatentable over Chess et aL, U.S. Patent No. 6,560,632 in view of Wong, U.S. Patent 
No. 5,974,465, in further view of McAfee (webpage). 

Issue # 3: The Examiner has rejected Claims 37-41 and 43-53 under 35 U.S.C. 103(a) 
as being unpatentable over Chess et aL, U.S. Patent No. 6,560,632 in view of Wong, 
U.S. Patent No. 5,974,465, in further view of Chiussi et al., U.S. Patent No, 6,532,21 3. 

Issue # 4: The Examiner has rejected Claim 54 under 35 U.S.C. 103(a) as being 
unpatentable over Chess et al., U.S. Patent No. 6,560,632 in view of Wong, U.S. Patent 
No. 5,974,465, in further view of Chiussi et al., U.S. Patent No. 6,532,21 3, in further 
view of McAfee (webpage). 

Issue # 5: The Examiner has. rejected Claims 55-59 under 35 U.S.C. 103(a) as being 
unpatentable over Chess et al., U.S. Patent No. 6,560,632 in view of Wong, U.S. Patent 
No. 5,974,465, in further view of Chiussi et al., U.S. Patent No. 6,532,213, in further 
view of "Chapter Thirteen Performance Tuning" (webpage), in further view of Using 
Netware 3.12 (webpage). 
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Vn ARGUMENTS (37 CF.R. § 41.37(c)(l)(vii)) 



The claims of the groups noted below do not stand or fall together. In the present 
section, appellant explains why the claims of each group are believed to be separately 
patentable. 



Issue # 1 : 



The Examiner has rejected Claims 1-11, 17, 19-23, 25-29 and 35 under 35 U.S.C. 
103(a) as being unpatentable over Chess et al., U.S. Patent No. 6,560,632 in view of 
Wong, U.S. Patent No. 5,974,465. 



Group n 1: Claims 1, 2, 17, 19, 20 and 35 



The Examiner has relied on the following excerpt from Chess to meet appellant's 
claimed: "checking a virus scan request to determine if scanning an object of the 
request is necessary; and placing the virus scan request on a queue in a priority order 
based on a characteristic of the virus scan request" (see Claim 1 and similar, but not 
identical, language in remaining independent claims). 



w The units of digital data preferably include queries or 
files. In one such embodiment, the distributed system 
includes a computer protection system and the units of 
digital data include files or checksums of files which are 
suspected to contain malicious code. The malicious code may 
include computer viruses, worms or Trojan Horses. 

It is preferable that the prioritizing step comprises the 
steps of: classifying the queued queries or files into 
categories, clustering the files, in each of the categories, 
into similarity clusters; choosing, for each similarity 
cluster, one or more representatives; and determining an 
order of processing for the one or more representatives. The 
classifying step preferably includes the step of classifying 
the queued queries or files according to the type of digital 
object they contain." (col. 3, lines 42-56) 



Appellant respectfully disagrees with this assertion. Specifically, Chess merely 
suggests classifying queries or files already queued, for prioritized processing. In 
sharp contrast, appellant teaches and claims placing the virus scan requests on a 
queue in a priority order based on a characteristic of the virus scan request, for 



-10- 
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prioritized queuing. Thus, Chess's prioritization (as well as Wong's, for that matter) 
is specific to a classification process that occurs after queuing, while appellant's 
prioritization is specific to the queuing process itselfduring queuing. 

In the Advisory Action dated 4/] 9/2005, the Examiner has stated that Chess' 
rearranging of the queue is still placing requests in a prioritized order onto a queue 
and it is not claimed that this should be done during queuing. Appellant respectfully 
disagrees with such an assertion. Specifically, appellant claims "placing the virus 
scan request on a queue in a priority order.. (emphasis added), and therefore 
clearly claims that the prioritizing is done during queuing. 

Still yet, the Examiner has relied on the following excerpt from Wong to meet 
appellant's claimed: "the characteristic including at least one of an identity of the 
user triggering the virus scan request ... wherein the virus scan request is prioritized 
based on at least one of the user identity being an administrator as compared to a 
regular user" (see Claim 1 and similar, but not identical, language in remaining 
independent claims). 

"Whenever an outbound packet is to be transmitted 

^ 0 ^ 1Zat i 0I \. S0f ? ware module 208 examines that packet to 
detenrune whether it should be stored in queue 209 The 

K«^ lt:lZatl0n so ? tware module 208 makes its determination 
based upon a particular configuration scheme, it is the 
function of software module 208 to initially configure the 
prioritization scheme. The configuration process entails 
specifying a number of different priority levels. For each of 
these Priority levels, the software module 208 Specifies a 
number of buffers within queue 209 which are to bfresSrved 
for that particular priority level. A buffer is a discrete 

l^i «S5wUf n,0ry -. W i? i « 13 V8ed Co score one Packet. The size of 
»r2 and buffers can vary, depending on the hardware 

and software considerations." (col. 4, lines 14-41) 

Appellant respectfully disagrees with this assertion. Specifically, there is absolutely 
no mention in the foregoing excerpt, nor the remaining Wong reference, of any sort 
of placing virus scan requests in a queue based on a virus scan request characteristic 
including "an identity of the user triggering the virus scan req n^t . . wherein the 
vims scan request is prioritized based on at least one of the user identity being an 
administrator as compared to a regular user" (emphasis added), as claimed. 



-11- 
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In the Advisory Action dated 4/19/2005, the Examiner has stated that Col. 4, lines 
27-41 of Wong teaches different users where the user is sending the request. 
Appellant respectfully asserts, however, that Wong teaches assigning priority based 
on input from either a user or network administrator. This clearly does not meet the 
specificity of appellant's claims, since such input does meet triggering a vim., scan 
request , as claimed. 

To establish a prima facie case of obviousness, three basic criteria must be met. 
First, there must be some suggestion or motivation, either in the references 
themselves or in the knowledge generally available to one of ordinary skin in the art, 
to modify the reference or to combine reference teachings. Second, there must be a 
reasonable expectation of success. Finally, me prior art reference (or references 
when combined) must teach or suggest all the claim limitations. The teaching or 
suggestion to make the claimed combination and the reasonable expectation of 
success must both be found in the prior art and not based on appellant's disclosure. 
In re Kaect.947F.2d 488, 20 USPQ2d 1438 (Fed.Cir.I991). Appellant respectfully 
asserts that at least the first and third elements of the prima facie case of 
obviousness have not been met. 

Appellant thus respectfully asserts that at least the third element of the prima facie 
case of obviousness has not been met, since the prior art references, when combined, 
fail to teach or suggest all of the claim limitations, as noted above. 

Still yet, with respect to the first element of the prima facie case of obviousness, the 
Examiner states that it would have been obvious to one of ordinary skill in the art at 
the time of the invention was made to use Wong's method of prioritization to 
prioritize the requests of Chess et al. Appellant respectfully disagrees with this 
proposition, especially in view of the vast evidence to the contrary. 

For example, Chess relates to a distributed security system, while Wong relates to a 
network data packet prioritization system To simply glean features from a network 
data packet prioritization system such as that of Wong, and combine the same with 
the non-analogous art of distributed s ecurity systems , such as that of Chess would 
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simply be improper. A network data packet prioritization system prioritizes data 
packets via a network device, while a distributed security system detects viruses, etc. 
"In order to rely on a reference as a basis for rejection of an appellant's invention, 
the reference must either be in the field of appellant's endeavor or, if not, then be 
reasonably pertinent to the particular problem with which the inventor was 
concerned.'' In re Oetiker, 977 F.2d 1443, 1446, 24 USPQ2d 1443, 1445 (Fed. Cir. 
1 992). See also In re Deminski, 796 F.2d 436, 230 USPQ 313 (Fed. Cir. 1 986); In re 
Clay, 966 F.2d 656, 659, 23 USPQ2d 1058, 1060-61 (Fed. Cir. 1992) In view of the 
vastly different types of problems a distributed security system addresses as opposed 
to a network data packet prioritization system, the Examiner's proposed combination 
is inappropriate. To simply dismiss appellant's unique application of prioritization 
techniques in the specific context of a security system would improperly frustrate 
the inventive concepts of appellant 

Group # 2: Claims 3 and 21 

The Examiner has relied on Col. 3, line 47-Col. 4 t line 5 of Chess to make a prior art 
showing of appellant's claimed "wherein selecting is based on the priority order." 
Appellant respectfully asserts that the only "selecting" taught by the above excerpt 
simply relates to selecting "N smallest files in each cluster as the one or more 
representatives. . Further, the only priority taught by Chess relates to prioritizing 
the representatives (see Col 3, lines 52-53). Therefore, the actual selecting of files 
to be representatives cannot be prioritized since the prioritizing only happens once 
the representatives are selected (see Col. 4, line 1). 

Appellant respectfully asserts that at least the third element of the prima facie case 
of obviousness has not been met, for the reasons set forth hereinabove. 

Group # 3: Claims 4, 9, 22 and 27 

The Examiner has relied on Col. 3, line 47-Col. 4, line 5 of Chess to make a prior art 
showing of appellant's claimed ''wherein selecting is based on the characteristic of 
the virus scan request." Such excerpt however, merely teaches that "selecting N 
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smallest files in each cluster as the one or more representatives. . There is simply 
no disclosure of any basis from which such files are selected, and therefore no 
disclosure of such basis being the "characteristic of the virus scan request" in the 
manner claimed by appellant. 

Appellant respectfully asserts that at least the third element of the prima facie case 
of obviousness has not been met, for the reasons set forth hereinabove. 

Group # 4: Claims 5 and 23 

The Examiner has relied on Col. 4, lines 6-13 of Chess to make a prior art showing, 
of appellant's claimed "scanning the object of the selected virus scan request." 
However, such excerpt merely teaches "updating the prioritizing information " and 
thus there is not even a suggestion of actually scanning an object. 

Appellant respectfully asserts that at least the third element of the prima facie case 
of obviousness has not been met, for the reasons set forth hereinabove. 

Group # 5: Claims 7, 8, 25 and 26 

The Examiner has relied on Col. 3, lines 48-64 of Chess to make a prior art showing 
of appellant's claimed technique "wherein the priority order is further based on 
comparing the characteristics of the vims scan request with the characteristics of the 
virus scan requests previously placed on the queue." Appellant respectfully asserts 
that such excerpt relied on by the Examiner simply discloses that files are clustered 
according to a code-similarity measure evaluated on a probably-malicious part of 
each file. Therefore, files that are presently in the queue are prioritized according to 
their code, and thus there is no teaching of "comparing the characteristics of the 
virus scan request with the characteristics of the virus scan requests previously 
placed on the queue," as claimed by appellant. 

Appellant respectfully asserts that at least the third element of the prima facie case 
of obviousness has not been met, for the reasons set forth hereinabove. 
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Group # 6: Claims 10, 1L 28 and 29 

The Examiner has relied on Col. 4, lines 9-1 3 of Chess to make a prior art showing 
of appellant's claimed "wherein selecting is further based on comparing the 
characteristics of the virus scan requests placed in the queue with the characteristics 
of the previously selected virus scan requests whose objects are currently being 
scanned." Such excerpt, however, only discloses updating prioritization information 
based on identifying other queued files as being in the same cluster as a file that has 
been determined to be malicious. There is simply no disclosure of "objects currently 
being scanned," in the context claimed by appellant. 

Appellant respectfully asserts that at least the third element of the prima facie case 
of obviousness has not been met, for the reasons set forth hereinabove. 

Issue # 2: 



The Examiner has rejected Claims 1 8 and 36 under 35 U.S.C. 1 03(a) as being 
unpatentable over Chess et al., U.S. Patent No. 6,560,632 in view of Wong, U.S. Patent 
No. 5,974,465, in further view of McAfee (webpage). 

Group # 1: Claims 18 and 36 

Such claims are deemed allowable for the reasons base Claim 1 is deemed 
allowable. 

Issue # 3: 

The Examiner has rejected Claims 37-41 and 43-53 under 35 U.S.C. 1 03(a) as being 
unpatentable over Chess et al., U.S. Patent No. 6,560,632 in view of Wong, U.S. Patent 
No. 5,974,465, in further view of Chiussi et al., U.S. Patent No. 6,532,213. 

Group # /; Claims 37, 38 and 53 
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Such claims are deemed allowable for the reasons based Claim 1 is deemed 
allowable. 

In addition, the Examiner has relied on the following excerpt from Chiussi to meet 
appellant's claimed "characteristics including ... a time stamp of when the virus 
request was received . . . wherein the virus scan request is prioritized based on ... the 
time stamp being earlier than the time stamps of each scan request previously placed 
on the queue." 

"A system is disclosed that services a plurality of queues 
associated with respective data connections in a packet 
communication network such that the system guarantees data 
transfer delays between the data source and the destination 
of each data connection. This is achieved in two stages. The 
first stage shapes the traffic of each connection such that 
it conforms to a specified envelope. The second stage 
associates timestamps with the packets released by the fxrst 
stage and chooses for transmission from among them the one 
with the smallest timestamp. Both stages are associated with 
a discrete set of delay classes.. The first stage employs one 
shaping structure per delay class. Each shaping structure in 
turn supports a discrete set of rates and employs a FIFO of 
connections per supported rate. A connection may move between 
FIFOs corresponding to different rates as its rate 
requirement changes. The second stage associates with each 
packet exiting the first stage a timestamp given by the exit 
time from the first stage and the delay class to which the 
connection belongs. A queue of packets is maintained per 
delay class, and the scheduler selects for transmission from 
among the packets at the head of the queues the one with the 
smallest timestamp." (Abstract) 

Appellant respectfully disagrees with this assertion. Specifically, there is absolutely 
no mention in the foregoing excerpt, nor the remaining Chiussi reference, of any sort 
of placing virus scan requests in a queue based on a vims scan request characteristic 
including "a time stamp of when the virus requ est was received . . . wherein the 
virus scan Tequest is prioritized based on ... the time stamp being earlier than the 
time stamps of each scan request previously plac ed on the queue" (emphasis added), 
as claimed. 

In the Advisory Action dated 4/19/05, the Examiner has argued that Chhissi teaches 
timestamps and the smallest timestamp being used first However, appellant 
respectfully asserts that Chiussi only "associates timestamps with the packets released 
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by the first stage" where the first stage "shapes the traffic of each connection such that it 
conforms to a specified envelope." Therefore, the timestamp only relates to the first 
stage, as described above, and not to when a virus request is received, in the manner 
claimed by appellant. In addition, in Chiussi, the packet with the smallest time stamp is 
transmitted, and not prioritized with other virus scan requests, in the manner claimed by 
appellant. 

Appellant respectfully asserts that at least the third element of the prima facie case 
of obviousness has not been met, for the reasons set forth hereinabove. 

Group #2: Claim 39 

The Examiner has relied on Col. 3, line 47-Col. 4, line 5 of Chess to make a prior art 
showing of appellant's claimed technique 'Svherein the selection is based on the 
priority order." Appellant respectfully asserts that the only "selecting" taught by the 
above excerpt simply relates to selecting **N smallest files in each cluster as the one 
or more representatives. . Further, the only priority taught by Chess relates to 
prioritizing the representatives (see Col. 3, lines 52-53). Therefore, the actual 
selecting of files to be representatives cannot be prioritized since the prioritizing 
only happens once the representatives are selected (see Col. 4, line 1). 

Appellant respectfully asserts that at least the third element of the prima facie case 
of obviousness has not been met, for the reasons set forth hereinabove. 

Group # 3: Claims 40 and 45 

The Examiner has relied on Col. 3, line 47-Col. 4, line 5 of Chess to make a prior art 
showing of appellant's claimed technique 'Vherein the selection is based on the 
characteristic of the virus scan request." Such excerpt however, merely teaches that 
"selecting N smallest files in each cluster as the one or more representatives. . ." 
There is simply no disclosure of any basis from which such files are selected, and 
therefore no disclosure of such basis being the "characteristic of the virus scan 
request," in the manner claimed by appellant. 
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Appellant respectfully asserts that at least the third element of the prima facie case 
of obviousness has not been met, for the reasons set forth hereinabove. 

Group # 4: Claims 41 

The Examiner has relied on Col. 4, lines 6-13 of Chess to make a prior art showing 
of appellant's claimed "scanner thread [that] further scans the object of the selected 
virus scan request." However, such excerpt merely teaches "updating the 
prioritizing information/' and thus there is not even a suggestion of actually 
scanning an object 

Appellant respectfully asserts that at least the third element of the prima facie case 
of obviousness has not been met, for the reasons set forth hereinabove. 

Group # 5: Claims 43 and 44 

The Examiner has relied on Col. 3, lines 48-64 of Chess to make a prior art showing 
of appellant's claimed technique "wherein the priority order is further based on 
comparing the characteristics of the virus scan request with the characteristics of the 
virus scan requests previously placed on the queue." Appellant respectfully asserts 
that such excerpt relied on by the Examiner simply discloses that files are clustered 
according to a code-similarity measure evaluated on a probably-malicious part of 
each file. Therefore, files that are presently in the queue are prioritized according to 
their code, and thus there is no teaching of "comparing the characteristics of the 
virus scan request with the characteristics of the virus scan requests previously 
placed on the queue," as claimed by appellant. 

Appellant respectfully asserts that at least the third element of the prima facie case 
of obviousness has not been met, for the reasons set forth hereinabove. 

Group # 6: Claims 46 and 47 
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The Examiner has relied on Col. 4, lines 9-13 of Chess to make a prior art showing 
of appellant's claimed 'Vherein the selection is further based on comparing the 
characteristics of the virus scan requests placed in the queue with the characteristics 
of the previously selected virus scan requests whose objects are currently being 
scanned." Such excerpt, however, only discloses updating prioritization information 
based on identifying other queued files as being in the same cluster as a file that has 
been determined to be malicious. There is simply no disclosure of "objects currently 
being scanned," in the context claimed by appellant. 

Appellant respectfully asserts that at least the third element of the prima facie case 
of obviousness has not been met, for the reasons set forth hereinabove. 

Issue # 4: 

The Examiner has rejected Claim 54 under 35 U.S.C. 103(a) as being unpatentable over 
Chess et al., U.S, Patent No. 6,560,632 in view of Wong, U.S. Patent No. 5,974,465, in 
further view of Chiussi et al., U.S. Patent No. 6,532,213, in further view of McAfee 
(webpage). 

Group # /: Claim 54 

Such claim is deemed allowable for the reasons base Claim 37 is deemed allowable. 
Issue # 5: 

The Examiner has rejected Claims 55-59 under 35 U.S.C. 103(a) as being unpatentable 
over Chess et al, U.S. Patent No. 6,560,632 in view of Wong, U.S. Patent No. 
5,974,465, in further view of Chiussi et al., U.S. Patent No. 6,532,213, in further view of 
"Chapter Thirteen Performance Tuning" (webpage), in further view of Using Netware 
3.12 (webpage). 

Group # 1: Claims 55 and 56 
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Such claim is deemed allowable for the reasons Claim 1 is deemed allowable. 

In addition, the Examiner has relied on the following excerpts from Performance and 
NetWare to meet appellant's claimed "the characteristic including .... a type of the 
process accessing the object... and an indication of a network node accessing the 
object, wherein the virus scan request is prioritized based on .... the process type 

being an operating system as compared to a user appellant and the indication 

being that the object is accessed from a server console as compared to a network 
client" (see Claim 55 and similar, but not identical, language in remaining 
independent claims). 

Application Priority 

• 0-15; User-accessible process priorities 

c 0-6: Low user range 
c 4; Low value 
c 7: Normal 
o 13; High value 
^ o 8-15: High user range 

• 16-31 : System-accessible process priorities 

°o £%2££X£~ aCCeSSib ' e '° Admi ™**°r-leve. accounts 
* 25-3 1 : Real-time value accessible to operating system only 

(see page 4 of Performance) 



SEND 

BROADCAST are treated as high-priorivllcmwS 

with SEND by using the CAS TOFF co m L nd , ta BKO^CAST^Z ^0^^^ *" 
(see page 7 of Netware) 

The Examiner has also argued that "Performance teaches prioritization based on 
process types (see page 4) and Netware teaches prioritization based on network node 
type (see page 8)." Appellant respectfully disagrees with such assertion, as it 
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appears 
claims. 



that the Examiner has simply failed to consider the full weight of appellant's 



Specifically, the Performance excerpt above simply fails to meet appellant's claimed 
"characteristic including .... a type of the process accessing the object... wherein the 
virus scan request is prioritized based on .... the process type being an operating 
system as compared to a user application" (emphasis added). As clearly set forth in 
the relevant excerpts hereinabove, Performance suggests processes that are 
accessible by user and system ap plications , and fall short of a process that 
specifically accesses the object , as claimed, where one of the process types is an 
operation system process (note that a system application does not meet an operating 
system). 

Further, the Netware excerpt above fails to meet appellant's claimed "characteristic 
including ....an indication of a network node accessing the object wherein the virus 
scan request is prioritized based on ... the indication being that the object is accessed 
from a server console as compared to a network client ." Again, similar to the 
Performance reference, Netware does not meet appellant's claimed node that 
accesses the object , as claimed. Instead Network merely suggests two types of 
messages, one sent using a SEND feature, and one sent using a BROADCAST 
feature. 

In the Advisory Action dated 4/19/05, the Examiner has stated that page 4 of 
Performance at 25-31 in the last part of the list teaches operating system processes. 
However, appellant respectfully asserts that the above excerpt does not teach "a type 
of process accessing the object" where the object is the item that is requested to be 
scanned (see Claim 55). 

Also in the Advisory Action dated 4/19/05, the Examiner has stated that "the SEND 
feature teaches the server console and the BROADCAST feature teaches a network 
client which make the requests." Appellant respectfully asserts that SEND, as in 
Netware, does not teach an indication of a network node accessing an object, as 
claimed, since it only relates to messages sent between workstations . In addition, 
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BROADCAST, as in Netware, is simply a message sent by Netware to all users. 
Again, there is no accessing of an object, as claimed by appellant. In addition, even 
if receiving the message did indicate accessing an object, Netware would still not 
meet appellant's specific claim language since, in both the SEND and 
BROADCAST instances, a workstation (user) is receiving the message, and 
appellant claims the object being "accessed from a server console as compared to a 
network client." 

Appellant respectfully asserts that at least the third element of the prima facie case 
of obviousness has not been met, for the reasons set forth hereinabove. 

Group #2: Claim 57 

The Examiner has relied on Col. 3, line 47-CoI. 4, line 5 of Chess to make a prior art 
showing of appellant's claimed "wherein selecting is based on the priority order." 
Appellant respectfully asserts that the only "selecting" taught by the above excerpt 
simply relates to selecting "N smallest files in each cluster as the one or more 
representatives. . Further, the only priority taught by Chess relates to prioritizing 
the representatives (see Col. 3, lines 52-53), Therefore, the actual selecting of files 
to be representatives cannot be prioritized since the prioritizing only happens once 
the representatives are selected (see Col. 4, line 1). 

Appellant respectfully asserts that at least the third element of the prima facie case 
of obviousness has not been met, for the reasons set forth hereinabove. 

Group #3: Claim 58 

The Examiner has relied on CoL 3, line 47-CoI. 4, line 5 of Chess to make a prior art 
showing of appellant's claimed "wherein selecting is based on the characteristic of 
the virus scan request." Such excerpt however, merely teaches that "selecting N 
smallest files in each cluster as the one or more representatives.. ." There is simply 
no disclosure of any basis from which such files are selected, and therefore no 
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disclosure of such basis being the "characteristic of the virus scan request " in the 
manner claimed by appellant. 

Appellant respectfully asserts that at least the third element of the prima facie case 
of obviousness has not been met, for the reasons set forth hereinabove. 

Group # 4: Claim 59 

The Examiner has relied on Col. 4, lines 6-13 of Chess to make a prior art showing 
of appellants claimed "scanning the object of the selected virus scan request." 
However, such excerpt merely teaches Updating the prioritizing information," and 
thus there is not even a suggestion of actually scanning an object. 

Appellant respectfully asserts that at least the third element of the prima facie case 
of obviousness has not been met, for the reasons set forth hereinabove. 

In view of the remarks set forth hereinabove, all of the independent claims are deemed 
allowable, along with any claims depending therefrom. 
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VIII APPENDIX OF CLAIMS (37 C.F.R. § 41.37(c)(l)(viii)) 

The text of the claims involved in the appeal (along with associated status information) 
is set forth beJow: 

1 . (Previously Presented) A method for prioritizing virus scan requests comprising: 
checking a virus scan request to determine if scanning an object of 
the request is necessary; and 

placing the virus scan request on a queue in a priority order based on 
a characteristic of the vims scan request, the characteristic including at least 
one of an identity of the user triggering the virus scan request, a type of the 
process accessing the object, a time stamp of when the virus request was 
received, and an indication of a network node accessing the object, wherein 
the virus scan request is prioritized based on at least one of the user identity 
being an administrator as compared to a regular user, the process type being 
an operating system as compared to a user appellant, the time stamp being 
earlier than the time stamps of each scan request previously placed on the 
queue, and the indication being that the object is accessed from a server 
console as compared to a network client. 

2. (Original) The method of claim 1 , further comprising: 

selecting a one of the virus scan requests from the queue. 

3. (Original) The method of claim 2, wherein selecting is based on the priority 
order. 

4. (Original) The method of claim 2, wherein selecting is based on the 
characteristic of the virus scan request. 

5. (Original) The method of claim 2, further comprising: 

scanning the object of the selected virus scan request. 

6. (Cancelled) 
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7. (Original) The method of claim I , wherein the priority order is further based on 
comparing the characteristic of the virus scan request with the characteristics of 
the virus scan requests previously placed on the queue. 

8. (Original) The method of claim 7, wherein the priority order is further based on ; 
parameter indicating which of the compared characteristics is given higher 
priority. 

9. (Original) The method of claim 4, wherein selecting is further based on 
comparing the characteristics of the virus scan requests placed in the queue. 

10. (Original) The method of claim 9, wherein selecting is further based on 
comparing the characteristics of the virus scan requests placed in the queue with 
the characteristics of the previously selected virus scan requests whose objects 
are currently being scanned. 

1 1 . (Original) The method of claim 10, wherein selecting is further based on a 
parameter indicating which of the compared characteristics is given higher 
priority. 

12. (Cancelled) 

13. (Cancelled) 

14. (Cancelled) 

15. (Cancelled) 

16. (Cancelled) 

17. (Original) The method of claim 1, wherein scanning is necessary when a virus 
scan status indicates the object is not known to be virus free. 
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18. (Original) The method of claim 1, wherein scanning is necessary when the object 
of the virus scan request is in a directory not excluded from virus scanning. 

19. (Previously Presented) An apparatus comprising: 

a machine-accessible medium having stored thereon executable 
instructions to cause a computer to perform 

checking a virus scan request to determine if scanning is necessary; 

and 

placing the virus scan request on a queue in a priority order based on 
a characteristic of the vims scan request, the characteristic including at least 
one of an identity of the user triggering the virus scan request, a type of the 
process accessing the object, a time stamp of when the vims scan request 
was received, and an indication of a network node accessing the object, 
wherein the virus scan request is prioritized based on at least one of the user 
identity being an administrator as compared to a Tegular user, the process 
type being an operating system as compared to a user application, the time 
stamp being earlier than the time stamps of each scan request previously 
placed on the queue, and the indication being that the object is accessed from 
a server console as compared to a network client. 

20. (Original) The apparatus of claim 19 s further comprising instructions for 
selecting a one of the virus scan requests from the queue. 

21 . (Original) The apparatus of claim 20, wherein the instructions for selecting is 
based on the priority order. 

22. (Original) The apparatus of claim 20, wherein the instructions for selecting is 
based on the characteristic of the virus scan request. 

23. (Original) The apparatus of claim 20, further comprising instructions for 
scanning the object of the selected virus scan request 



-26- 



PAGE 31/38 " RCVD AT 6/28/2005 6:35:48 PM {Eastern Daylight Time] * SVR:USPTO-EFXRF-1/1 * DNIS: 8729306 * CStD:408 071 4660 * DURATION <mm-ss):11-06 



Jun 28 05 03: 



45 P 



SVIPG 



408 971 4GB0 



p. 32 



24. (Cancelled) 

25. (Original) The apparatus of claim 20, wherein the instructions for placing the 
virus scan request on the queue m the priority order are further based on 
comparing the characteristic of the virus scan request with the characteristics of 
the virus scan requests previously placed on the queue. 

26. (Original) The apparatus of claim 25, wherein the instructions for placing the 
virus scan request on the queue in the priority order are further based on a 
parameter indicating which of the compared characteristics is given higher 
priority. 

27. (Original); The apparatus of claim 20, wherein the instructions for selecting are 
further based on comparing the characteristics of the virus scan requests placed 
in the queue. 

28. (Original) The apparatus of claim 27, wherein the instructions for selecting are 
further based on comparing the characteristics of the virus scan requests placed 
in the queue with the characteristics of the previously selected virus scan 
requests whose objects are currently being scanned. 

29. (Original) The apparatus of claim 27, wherein the instructions for selecting are 
further based on a parameter indicating which of the compared characteristics is 
given higher priority. 



30. 



(Cancelled) 



31. 



(Cancelled) 



32. 



Cancelled) 



33. 



(Cancelled) 



-27- 



PACE 32/38 • RCVD AT 6/28/2005 6:35:48 PM [Eastern Daylight Time] * SVR:USPTO-EFXRF-1/1 * DNIS:8729306 • CSID:408 971 4680 * DURATION (mm«SS): 11-06 



Jun 28 05 03:45p 



SVIPG 



408 971 4660 



p- 33 



34. (Cancelled) 

35. (Original) The apparatus of claim 19, wherein the instructions for checking to 
determine if scanning is necessary include determining when a virus scan status 
indicates the object is not known to be virus free. 

36. (Original) The apparatus of claim 19, wherein the instructions for checking to 
determine if scanning is necessary include determining when the object of the 
virus scan request is in a directory not excluded from virus scanning. 

37. (Previously Presented) A virus scanner comprising: 

a pre-processor thread that checks a vims scan request to determine if 
scanning an object of the request is necessary; 

a queue that receives the virus scan request in a priority order based 
on characteristics of the virus scan request, the characteristics including at 
least two of an identity of the user triggering the virus scan request, a type of 
the process accessing the object, a time stamp of when the virus scan request 
was received, and an indication of a network node accessing the object, 
wherein the virus scan request is prioritized based on at least two of the user 
identity being an administrator as compared to a regular user, the process 
type of being an operating system as compared to a user application, the 
time stamp being earlier than the time stamps of each scan request previously 
placed on the queue, and the indication being that the object is accessed from 
a server console as compared to a network client. 

38. (Original) The virus scanner of claim 37, further comprising: 

a scanner thread that selects a one of the virus scan requests from the 

queue. 

39. (Original) The virus scanner of claim 38, wherein the selection is based on the 
priority order. 
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40. (Original) The virus scanner of claim 38, wherein (he selection is based on the 
characteristic of the virus scan request. 

41 . (Original) The virus scanner of claim 38, wherein the scanner thread further 
scans the object of the selected virus scan request. 

42. (Cancelled) 

43. (Original) The virus scanner of claim 37, wherein the priority order is further 
based on comparing the characteristic of the virus scan request with the 
characteristics of the virus scan requests previously placed on the queue. 

44. (Original) The virus scanner of claim 43, wherein the priority order is further 
based on a parameter indicating which of the compared characteristics is given 
higher priority. 

45. (Original) The virus scanner of claim 40, wherein the selection is further based 
on comparing the characteristics of the virus scan requests placed in the queue. 

46: (Original) The virus scanner of claim 45, wherein the selection is further based 
on comparing the characteristics of the virus scan requests placed in the queue 
with the characteristics of the previously selected virus scan requests whose 
objects are currently being scanned. 

47. (Original) The virus scanner of claim 46, wherein the selection is further based 
on a parameter indicating which of the compared characteristics is given higher 
priority. 

48. (Cancelled) 

49. (Cancelled) 

50. (Cancelled) 
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51. (Cancelled) 

52. (Cancelled) 

53. (Original) The virus scanner of claim 37, wherein determining that scanning is 
necessary includes determining when a virus scan status indicates the object is 
not known to be virus free. 

54. (Original) The virus scanner of claim 37, wherein determining that scanning is 
necessary includes determining when the object of the virus scan request is in a 
directory not excluded from virus scanning. 

55. (Previously Presented) A computer system comprising: 

a processor coupled to a system bus; 
a memory coupled to the processor through the system bus; 
a machine-accessible medium coupled to the processor through the 
system bus; 

a virus scanning process executed from the machine-accessible 
medium by the processor, wherein the virus scanning process causes the 
processor to check a virus scanning request to determine if scanning an 
object of the request is necessary, and if so to further place the checked virus 
scan request on a queue in a priority order based on characteristics of the 
virus scan request, the characteristics including each of an identity of the user 
triggering the virus scan request, a type of the process accessing the object, a 
time stamp of when the virus scan request was received, and an indication of 
a network node accessing the object, wherein the virus scan request is 
prioritized based on the user identity being an administrator as compared to a 
regular user, the process type being an operating system as compared to a 
user application, the time stamp being earlier than the time stamps of each 
scan request previously placed on the queue, and the indication being that the 
object is accessed from a server console as compared to a network client. 
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56. (Original) The computer system of claim 55, wherein the virus scanning process 
further causes the processor to select a one of the virus scan requests from the 
queue. 

57. (Original) The computer system of claim 56, wherein the selection is based on 
the priority order. 

58. (Original) The computer system of claim 56, wherein the selection is based on 
the characteristic of the virus scan request. 

59. (Original). The computer system of claim 56, wherein the virus scanning process 
further causes the processor to scan the object of the selected virus scan request. 

60. (Cancelled) 
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IX APPENDIX LISTING ANY EVIDENCE RELIED ON BY THE APPELLANT 
IN THE APPEAL (37 C.F.R. § 41.37(c)(l)(ix)) 

There is no such evidence. 
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In the event a telephone conversation would expedite the prosecution of this application, the 
Examiner may reach the undersigned at (408) 971-2573. For payment of any additional fees due in 
connection with the filing of this paper, the Commissioner is authorized to charge such fees to 
Deposit Account No. 50-1351 (Order No. NAI1P360_00.0 148.01). 



Respectfully submitted, / 




By: 

Kevin J. Zilka 
Reg. No. 4yfc 



Zilka-Kotab, P.C. 

P.O. Box 721 120 

San Jose, California 95172-1 120 

Telephone: (408) 971-2573 

Facsimile: (408) 971-4660 



Date: 
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